> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bedrock.quarry-systems.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bedrock Authorization Platform

> Unified authorization for users, services, and AI agents

**The authorization engine for the AI era.** Govern users, services, and AI agents with hierarchical scopes, resource policies, and conditional permissions.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Get started in 5 minutes
  </Card>

  <Card title="Core Concepts" icon="book" href="/concepts/index">
    Understand the fundamentals
  </Card>
</CardGroup>

***

## Why Bedrock?

Bedrock solves authorization problems traditional RBAC cannot:

<CardGroup cols={3}>
  <Card title="Hierarchical Scopes" icon="sitemap">
    Org → Workspace → Project → Environment with full inheritance
  </Card>

  <Card title="Resource Policies" icon="shield-check">
    Fine-grained allow/deny on specific resources or collections
  </Card>

  <Card title="Conditional Permissions" icon="code">
    JSON Logic expressions for dynamic, context-aware access
  </Card>

  <Card title="AI Agent Governance" icon="robot">
    Same authorization model for users, services, and AI agents
  </Card>

  <Card title="Multi-tenant Isolation" icon="building">
    Complete tenant separation with scope hierarchies
  </Card>

  <Card title="Tag-based Access" icon="tags">
    Dynamic permissions based on resource and subject tags
  </Card>
</CardGroup>

***

## How It Works

```
EVALUATION ORDER
  1. Reachability gate   → resource must be reachable in the scope (when enabled)
  2. Delegation grant    → required when acting on behalf of another subject
  3. Resource policies   → explicit allow/deny (deny wins within the top priority group)
  4. Role-based perms    → subject → scope → role → permission (composed per permissionMode)
  5. Ownership           → an owner-role grant on an owned resource
  6. Resource hierarchy  → a parent resource can grant via a cascade: inherit edge
```

<Card title="Learn about Evaluation" icon="gears" href="/concepts/evaluation">
  Understand how Bedrock decides if an action is allowed
</Card>

***

## Core Concepts

| Concept        | Description                                 | Learn More                                       |
| -------------- | ------------------------------------------- | ------------------------------------------------ |
| **Scope**      | Hierarchical node (org, workspace, project) | [Scopes →](/concepts/scopes)                     |
| **Subject**    | Actor: user, service, agent, api\_key       | [Subjects →](/concepts/subjects)                 |
| **Role**       | Bundle of permissions assigned to subjects  | [Roles →](/concepts/roles)                       |
| **Permission** | Action + resource type + pattern            | [Permissions →](/concepts/permissions)           |
| **Resource**   | Protected object with type and owner        | [Resources →](/resources/index)                  |
| **Collection** | Dynamic resource group via match rules      | [Collections →](/resources/resource-collections) |
| **Policy**     | Allow/deny rule on resource or collection   | [Policies →](/resources/resource-policies)       |
| **Tag**        | Metadata for conditional access             | [Tags →](/tags/index)                            |

***

## Quick Example

Set up your authorization structure via the **REST API**, then evaluate. The engine is **read/evaluate-only**—all writes go through the API.

```bash theme={null}
# 1. Create a scope, role, permission, and link them
curl -X POST '.../scopes'           -d '{"typeId":"org","name":"Acme Corp"}'
curl -X POST '.../roles'            -d '{"name":"Editor","scopeId":"scope_acme"}'
curl -X POST '.../permissions'      -d '{"scopeId":"scope_acme","action":"write","resourceType":"document","resourcePattern":"*","key":"document:write:*"}'
curl -X POST '.../role-permissions' -d '{"roleId":"role_editor","permissionId":"perm_1"}'

# 2. Add the subject as a member and assign the role
curl -X POST '.../memberships'      -d '{"subjectId":"subject_jane","scopeId":"scope_acme"}'
curl -X POST '.../role-assignments' -d '{"membershipId":"membership_1","roleId":"role_editor"}'
```

```typescript theme={null}
// 3. Evaluate with the embedded engine
import { BedrockEngine } from '@quarry-systems/bedrock-core';
import { createPostgresStore } from '@quarry-systems/bedrock-core-storage';

const bedrock = new BedrockEngine(createPostgresStore({ connectionString: process.env.DATABASE_URL }));

const decision = await bedrock.evaluate({
  actor: { subjectId: 'subject_jane', subjectType: 'user' },
  scopeId: 'scope_acme',
  action: 'write',
  resource: { resourceType: 'document', resourcePattern: '*' },
});

console.log(decision.allowed); // true
```

<Card title="Full Quickstart Guide" icon="rocket" href="/quickstart">
  Complete setup with all features
</Card>

***

## Use Cases

<CardGroup cols={2}>
  <Card title="User Governance" icon="user-shield" href="/guides/user-governance">
    Traditional RBAC for users across your organization hierarchy
  </Card>

  <Card title="Agent Governance" icon="robot" href="/guides/agent-governance">
    Control what AI agents can access and do within your systems
  </Card>

  <Card title="Multi-tenant Apps" icon="building" href="/guides/multi-tenant">
    Isolate permissions across tenants with hierarchical scopes
  </Card>

  <Card title="SaaS Platforms" icon="cloud" href="/guides/modeling-saas">
    Model complex SaaS authorization with workspaces and projects
  </Card>
</CardGroup>

***

## AI Agent Governance

As organizations deploy AI agents (LLM-powered assistants, autonomous workflows, MCP servers), they face new challenges:

| Challenge                     | Bedrock Solution             |
| ----------------------------- | ---------------------------- |
| What can this agent access?   | Scoped permissions via roles |
| Can I trust this agent here?  | Scope-level overrides        |
| How do I audit agent actions? | Unified subject model        |
| How do I revoke agent access? | Same as revoking user access |

Bedrock treats agents as first-class subjects (registered via the REST API, same as any subject):

```bash theme={null}
# Register an AI agent
curl -X POST '.../subjects' \
  -d '{"subjectType":"agent","externalId":"openai-assistant-123"}'

# Add to a scope with a restricted role (read-only in production)
curl -X POST '.../memberships' \
  -d '{"subjectId":"agent_assistant","scopeId":"scope_production"}'
curl -X POST '.../role-assignments' \
  -d '{"membershipId":"membership_agent","roleId":"role_readonly"}'
```

<Card title="Agent Governance Guide" icon="robot" href="/guides/agent-governance">
  Complete guide to managing AI agent permissions
</Card>

***

## API Reference

<CardGroup cols={2}>
  <Card title="REST API" icon="terminal" href="/api-reference/introduction">
    Complete API documentation for all endpoints
  </Card>

  <Card title="TypeScript SDK" icon="code" href="/quickstart">
    Native TypeScript/JavaScript integration
  </Card>
</CardGroup>